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REMARKS/ARGUMENTS 
Claims 1-30 are pending. The claims are not amended in this response, but are 

provided herewith for the examiner's convenience. 

Claims 1, 3-4, 6-8, 27, and 30 were rejected under 35 U.SC. § 102(b) for 
allegedly being anticipated by Hekhuis, U.S. Patent No. 5,414,650. 

Claims 2, 5, 9-1 1, 12-26, and 28-29 were rejected under 35 U.S.C. § 103(a) for 
allegedly being unpatentable over Hekhuis in view of Narad. 

The Pending Claims 

The claims sets are as follows: 

independent claim 1 and dependent claims 2-5; 
independent claim 6 and dependent claims 7-10; 
independent claim 1 1 and dependent claims 12-17; 
independent claim 18 and dependent claims 19-26; and 
independent claim 27 and dependent claims 28-30. 

The claims are directed to methods and apparatus for classifying network data by 
treating the data stream as a language. The network data stream is processed according to a 
language definition. Claim 1, for example, recites the combination of providing a language 
definition including a grammar and processing incoming network data with the language 
definition in accordance with a formal language processing technique, including parsing the 
network data using the grammar. 

Independent claim 6 further recites lexically scanning the data packet to produce 
tokens, and then parsing the tokens according to the grammar. 

Independent claim 1 1 recites receiving grammar rules in the form of a 
grammatical packet classifier and performing a compiling step to produce a grammar graph. The 
grammar graph is used to configure a programmable packet classifier. A data stream is then 
processed in accordance with a formal language processing technique using the grammatical 
packet classifier to identify protocol structure in the received data packet. 
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Independent claim 23 further recites a DFA defined by a language definition and 
decompression logic to process network data packets comprising a stream of data according to a 
formal language processing technique using the language definition. The DFA represents a 
grammar graph and regular expressions and is used to match the stream of data against the 
represented regular expressions to identify lexical tokens. 

Independent claim 27 recites means for receiving a network packet and for 
identifying protocol structure in the network packet. The network packet is processed according 
to formal language processing techniques using a language definition, including scanning to 
match patterns in the network data against regular expressions to produce lexical tokens. 

The Cited Art 

Hekhuis was cited in column 8, line 55 to column 9, line 6 for "a hash table of 
words are provided to provide a language definition." OA. at page 2, rejection of claim L As 
will be discussed in more detail below, the cited portion of Hekhuis discusses an example of a 
rule-based parsing of example text strings shown in Fig. 3. There is no discussion of a hash 
table. 

Narad et al. was cited for showing the use of a DFA. 

a) Hekhuis 

Hekhuis teaches "lossless compression," a technique that is similar to Lempel-Ziv 
(LZ compression) and is often referred to as "dictionary based compression" or "substitutional 
compression." The general concept is described in column 1 line 45-70. As an observational 
note, this method is used in popular lossless compression programs such as WinZip. 

b) Hekhuis does not show the recited "processing ... in accordance 
with a formal language processing technique" 

Hekhuis was cited in column 8, line 55 to column 9, line 37 (and also column 10, 
line 40 to column 11, line 42) for showing "packets are parsed according to parsing rules to 
identify words where packets are classified accordingly." OA. at page 3, first two lines. While it 
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is accurate that Hekhuis performs "parsing," it must be noted that he parsing of Hekhuis is 
performed in accordance with parsing rules ; i.e., it is rule-based . Application of the Hekhuis 
rules does not constitute processing using a language definition including a grammar and 
processing incoming network data with the language definition in accordance with a formal 
language processing technique, including parsing the network data using the grammar. The 
Hekhuis performs classification according to a simple rule; for example, if a letter belongs to the 
set {a, e, i, o, t}, then it is classified as a "cardinal", otherwise the letter is classified as a 
"collateral." There simply is no language definition in the rule, there is no grammar in the rule, 
there is no formal language processing technique when the rule is applied to the letter, and there 
is no parsing involved. 

Referring to the three example text strings of Fig. 3 and to his discussion 
beginning at column 8, line 30, Hekhuis discusses parsing each text string by establishing 
boundaries between packets at a level n+1 containing packets at a lower level n. With regard to 
the first text string in Fig. 3, each letter and space character is a "level-0 packet" and is classified 
as either cardinal packet or a collateral packet. Col 8, lines 48-50. The level-0 packet is defined 
by the classification Rule (3) in column 8, lines 7-8. The rule does not involve the recited 
processing of incoming network data with a language definition in accordance with a formal 
language processing technique. Instead, the rule merely designates a letter as being a "cardinal" 
if the letter is in the set of {a, e, i, o, t}, and a "collateral" otherwise. Likewise, the rule does not 
involve scanning using lexical token scanning. 

Continuing with the example of Fig. 3, Hekhuis next describes a level- 1 parsing 
rule that establishes a level- 1 packet boundary as a boundary "just before any cardinal packet 
which is immediately preceded by a collateral packet." Id at lines 58-60, These boundaries are 
shown as the medium-length lines and long length lines in Fig. 3. It is earnestly submitted that 
the rule for establishing level- 1 boundaries does not constitute the recited processing of incoming 
network data with a language definition in accordance with a formal language processing 
technique, including scanning using lexical token scanning. The rule for establishing level- 1 
boundaries does not constitute lexical token scanning. 



Page 10 of 12 



Appl. No. 09/557,736 PATENT 
Amdt. sent November 29, 2005 
Reply to Office Action of June 2, 2005 

Continuing further with the example of Fig. 3, Hekhuis describes a level-2 parsing 
rule that establishes a level-2 packet boundary as a boundary "just before any level- 1 cardinal 
packet that immediately follows a collateral packet." Id at lines 62-64. These boundaries are 
shown as the long-length lines in Fig. 3. As with the level- 1 rule above, it is earnestly submitted 
here that the rule for establishing level-2 boundaries does not constitute the recited processing of 
incoming network data with a language definition in accordance with a formal language 
processing technique, including scanning using lexical token scanning. The rule for establishing 
level-2 boundaries does not constitute lexical token scanning. 

Fig. 3 shows Hekhuis' rule-based parsing for two additional example text strings. 
These are discussed in column 9, lines 15-37. Hekhuis discuss other types of parsing rules from 
column 10, line 40 to column 11, line 42. Hekhuis discloses a local extrema parsing rule at 
column 10, lines 50-66 and column 11, lines 13-42, and an oscillating parsing rule at column 10, 
line 67 to column 11, line 12. It is earnestly submitted that in none of these discussions does 
Hekhuis disclose or suggest the recited processing of incoming network data with a language 
definition in accordance with a formal language processing technique, including scanning using 
lexical token scanning. 

As to the remaining independent claims 6, 1 1, 18, and 27, these claims each recite 
different and further aspects of the disclosed system and method. But each independent claim 
recites the language definition, grammar, and formal language processing technique, including 
parsing the network data using the grammar as recited in independent claim 1 . It is most 
earnestly submitted that these common limitations among the independent claims are not 
disclosed by Hekhuis. 
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PATENT 



CONCLUSION 



In view of the foregoing, Applicants believe all claims now pending in this 



Application are in condition for allowance. The issuance of a formal Notice of Allowance at an 
early date is respectfully requested. 



If the Examiner believes a telephone conference would expedite prosecution of 



this application, please telephone the undersigned at 650-326-2400. 



TOWNSEND and TOWNSEND and CREW LLP 

Two Embarcadero Center, Eighth Floor 

San Francisco, California 941 1 1-3834 

Tel: 650-326-2400 

Fax:415-576-0300 
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Respectfully submitted, 




George a. F. Yee 
Reg. No. 37,478 
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